Zach Zeid
09/17/2020, 2:27 PM| installed_homebrew_packages_1 | SELECT name, version from homebrew_packages order by name limit 25; | 14400 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
nyanshak
09/17/2020, 3:08 PMosqueryi --json "select * from osquery_schedule;"
, you don't actually have any queries scheduled.
You'd also have to pass a config file with the scheduled queries to osqueryi (or tls config) and wait for it to execute those queries before you get data on scheduled query execution.osquery_schedule
tableZach Zeid
09/17/2020, 3:09 PMnyanshak
09/17/2020, 3:09 PMZach Zeid
09/17/2020, 3:12 PMsudo osqueryi --profile 2 --profile-delay 1 "select * from users;" --json
nyanshak
09/17/2020, 3:36 PMZach Zeid
09/17/2020, 3:36 PMnyanshak
09/17/2020, 3:37 PMosquery/main/main.cpp
after grepping for profile
theopolis
osqueryi --connect /path/to/osqueryd/extension/socket.em
such that you could inspect the runtime status of an osqueryd
process. It sounds like that would be helpful here.